DEBIAN-CVE-2026-119718: Buffer Overflow
Published Oct 30, 2026
·Updated
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcachedataalloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.
Affected Software
2 affected components
debian/blender*
debian/blender*
Event History
Oct 30, 2026
CVE Published
via OSV·04:17 PM
Data Sourced
via OSV·04:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require elevated privileges or prior access to the target system?
No privileges are required according to the supplied CVSS vector, but exploitation is local and requires user interaction. The target user must open a .blend file accompanied by an attacker-crafted point cache file.
2
Which Blender release lines include the fix?
The issue is fixed in Blender 4.5.15 and Blender 5.2.3. Versions earlier than 4.5.15 in the 4.x line and earlier than 5.2.3 in the 5.x line are affected.